CVE-2025-4968

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-4968", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-05-19T20:58:07.027Z", "datePublished": "2025-07-24T03:39:04.762Z", "dateUpdated": "2026-04-08T16:36:03.519Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:36:03.519Z"}, "affected": [{"vendor": "wpbakery", "product": "WPBakery Page Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "8.4.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Page Builder elements (Copyright Element, Hover Box, Separator With Text, FAQ, Single Image, Custom Header, Button, Call To Action, Progress Bar, Pie Chart, Round Chart, and Line Chart) in all versions up to, and including, 8.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "WPBakery Page Builder <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Page Builder Elements", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/10945855-675a-4a85-8bb2-84bc40c1b826?source=cve"}, {"url": "https://kb.wpbakery.com/docs/preface/release-notes/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "timeline": [{"time": "2025-07-15T13:15:46.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-07-23T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-24T13:18:32.472672Z", "id": "CVE-2025-4968", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-24T13:18:37.467Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-4968", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-24T13:18:32.472672Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-24T13:18:34.628Z"}}], "cna": {"title": "WPBakery Page Builder <= 8.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Page Builder Elements", "credits": [{"lang": "en", "type": "finder", "value": "D.Sim"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpbakery", "product": "WPBakery Visual Composer", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "8.4.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-15T13:15:46.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-07-23T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/10945855-675a-4a85-8bb2-84bc40c1b826?source=cve"}, {"url": "https://kb.wpbakery.com/docs/preface/release-notes/"}], "descriptions": [{"lang": "en", "value": "The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Page Builder elements (Copyright Element, Hover Box, Separator With Text, FAQ, Single Image, Custom Header, Button, Call To Action, Progress Bar, Pie Chart, Round Chart, and Line Chart) in all versions up to, and including, 8.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-07-24T03:39:04.762Z"}}}, "cveMetadata": {"cveId": "CVE-2025-4968", "state": "PUBLISHED", "dateUpdated": "2025-07-24T13:18:37.467Z", "dateReserved": "2025-05-19T20:58:07.027Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-24T03:39:04.762Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WPBakery Page Builder", "vendor": "wpbakery", "versions": [{"lessThanOrEqual": "8.4.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wpbakery:page_builder:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "EE7A5CA9-B017-4D1D-AC7C-F590094929F9", "versionEndExcluding": "8.5", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WPBakery Page Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Page Builder elements (Copyright Element, Hover Box, Separator With Text, FAQ, Single Image, Custom Header, Button, Call To Action, Progress Bar, Pie Chart, Round Chart, and Line Chart) in all versions up to, and including, 8.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El complemento WPBakery Page Builder para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s de varios elementos del Page Builder (elemento de copyright, cuadro flotante, separador con texto, preguntas frecuentes, imagen \u00fanica, encabezado personalizado, bot\u00f3n, llamada a la acci\u00f3n, barra de progreso, gr\u00e1fico circular, gr\u00e1fico circular y gr\u00e1fico de l\u00edneas) en todas las versiones hasta la 8.4.1 incluida, debido a una depuraci\u00f3n de entrada insuficiente y al escape de salida en los atributos proporcionados por el usuario. Esto permite a atacantes autenticados, con acceso de colaborador o superior, inyectar scripts web arbitrarios en las p\u00e1ginas en las p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada."}], "id": "CVE-2025-4968", "lastModified": "2026-06-17T09:34:24.597", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-4968", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-24T13:18:32.472672Z", "version": "2.0.3"}}]}, "published": "2025-07-24T07:15:53.793", "references": [{"source": "security@wordfence.com", "tags": ["Release Notes"], "url": "https://kb.wpbakery.com/docs/preface/release-notes/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/10945855-675a-4a85-8bb2-84bc40c1b826?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T17:04:02.989043+00:00", "value": {"mitigation_remediation": ["Update WPBakery Page Builder to the latest release that resolves the stored XSS flaw; consult the vendor\u2019s release notes for version details.", "For environments that cannot upgrade immediately, disable write access for contributor roles to the affected Page Builder elements or block the plugin until a patch is applied.", "After upgrading, verify that user\u2011supplied attributes are properly escaped and that no legacy scripts remain; apply any vendor\u2011recommended security hardening steps such as enabling CSP or restricting script execution domains."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting (XSS)"}, "threat_synthesis": {"affected_systems": "The vulnerability affects all installations of WPBakery Page Builder version 8.4.1 or earlier. It applies to the WordPress plugin distributed by wpbakery and includes all supported page builder components. The plugin is widely deployed on many WordPress sites, making the scope of exposure broad for any site operating on the affected software version.", "description_and_impact": "A stored cross\u2011site scripting flaw exists in the WPBakery Page Builder WordPress plugin, allowing an authenticated user with contributor or higher access to inject arbitrary JavaScript into a page through several builder elements. The attacker can place malicious code into attributes of elements such as Copyright, Hover Box, FAQ, and various charts, and the script will run each time the page is viewed by any user. This vulnerability arises from insufficient input validation and output escaping and is classified as CWE\u201179.", "risk_and_exploitability": "The CVSS base score of 6.4 indicates a moderate level of severity. The EPSS score is reported as less than 1%, suggesting a low probability of exploitation at the time, and the vulnerability is not listed in CISA\u2019s KEV catalog. Because exploitation requires only contributor\u2011level access, it is relatively easy for authenticated users to leverage the flaw. The risk is moderate, especially on sites with many contributors."}}}}, "created": "2025-07-24T21:26:44.117999+00:00", "updated": "2026-04-22T17:15:22.193248+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpbakery", "wpbakery$PRODUCT$wpbakery_visual_composer"]}